Pausa Privacy Policy

App: Pausa (iOS)
Developer / data controller: Nexapps Bilişim ve Yazılım Hizmetleri Limited Şirketi, Soğanlık Yeni Mah., Soğanlık D-100 Kuzey Yanyol Cad., A Blok No: 72/2, İç Kapı No: 10, Kartal, İstanbul, Türkiye — operated by Furkan Tanrıöver
Contact: support@nexapps.co

1. The short version

Pausa is a perimenopause wellness journal that turns your daily check-ins into a weekly pattern narrative and a report you can bring to your clinician. It is built local-first:

• Your symptom history lives on your iPhone, not on our servers. Daily check-ins (symptoms, severity, sleep, cycle/spotting, HRT/supplement adherence) are stored in the app’s local database on your device, and we cannot read them. Pausa never writes them to iCloud; if you have iCloud Backup turned on, your iPhone’s own encrypted backup, which Apple runs, may include them (§3.1).
• The only health data Pausa ever sends off your device is a condensed, pseudonymous summary, sent transiently to generate your weekly narrative or monthly report — and only after you explicitly agree on the in-app consent screen. We never store that summary on our servers.
• The AI analysis is performed by Anthropic, our AI provider. It is named here because you have the right to know exactly who processes your data. Anthropic may not use your data to train its models under our agreement with them.
• No ads. No trackers. No sale of data. Ever. Pausa contains no advertising SDKs and does no cross-app tracking. The App Store privacy label’s “Data Used to Track You” section is empty by design.
• You can delete your account and data from inside the app, and you can revoke AI consent at any time — daily logging keeps working entirely on your device.

The rest of this policy is the long version of those five sentences.

2. Scope and definitions

This policy covers the Pausa iOS app and the nexapps platform services behind it. It does not cover Apple’s own processing (App Store purchases, iCloud Backup, iOS notifications), which Apple describes in its own privacy documentation.

• On-device data — data stored in Pausa’s local database on your iPhone (and in your iPhone’s own backup, if you use one — §3.1).
• Transient AI summary — the condensed, pseudonymous statistics derived from your logs that are sent to generate a narrative or report, processed in memory, and not stored by us.
• Account data — the minimal server-side records that make the service work (a random account identifier, device basics, subscription state).

3. What data we handle, and where it lives

3.1 Data stored on your iPhone (we never receive it)

Stored in Pausa’s local, on-device database (SwiftData). Pausa never writes your health data to iCloud: it uses no CloudKit sync and no iCloud Drive, as Apple’s App Review Guideline 5.1.3(ii) requires. Like the rest of your iPhone’s app data, the database is part of your iPhone’s own encrypted backup: if you have iCloud Backup turned on, that backup — which Apple runs, not us — may include it.

• Your daily check-ins: symptom selections (from Pausa’s curated perimenopause symptom list) with 1–5 severity, sleep quality, cycle/spotting entries, and HRT/supplement adherence entries you record.
• Your onboarding symptom-history quiz answers.
• The weekly narratives and monthly Appointment Report PDFs generated for you (they are delivered back to your device and stored there).
• Streaks, reminders, and app preferences.

Notes on control:

• Pausa’s check-in is tap-based; there is no free-text symptom field, so no free-text diary content exists to leave your device.
• You can create an encrypted local export of your data for backup or moving to a new iPhone; you control that file. There is no cross-device cloud sync in this version.
• If you share an Appointment Report with your clinician, you do that yourself through iOS share functions; we are not part of that transmission and never receive the report.
• If you delete the app without exporting, your on-device data is deleted with it. A backup of your iPhone made earlier — in iCloud Backup or on a computer — keeps its copy until that backup is replaced or deleted; those backups are yours and Apple’s, and we cannot reach them.

3.2 The transient AI summary (leaves your device only with your explicit consent)

To write your weekly pattern narrative (about once a week) and your monthly report summary, the app computes a condensed statistical summary on your device and sends it to our server. This happens only after you have accepted the in-app health-data and AI consent screen, and you can turn it off at any time.

Your de-identified summary is processed by Anthropic, our AI provider.

What the summary contains: aggregated statistics and structured severity series derived from your entries for the period being analyzed — e.g. symptom frequency and severity aggregates, sleep-quality aggregates, cycle-phase markers, and adherence indicators — plus non-identifying request metadata (app identifier, feature name, app version).

What it never contains: your name, email address, phone number, contacts, precise location, advertising identifiers, device fingerprints, photos, or free text (none exists — see §3.1).

The path it takes: your device → our server in Germany (EU) → Anthropic’s API, encrypted in transit (TLS) on both legs. Our server sends Pausa’s AI requests straight to Anthropic: they never pass through Cloudflare’s AI Gateway or any other AI routing service. The provider is:

• Anthropic, PBC (United States) — our AI provider. It stores requests in the United States and may process them in the United States, Europe, Asia or Australia; for safety review, product support or incident response, it may also process them in other countries where it or its affiliates operate.

What is stored, and by whom:

• nexapps stores none of it. The summary and the generated narrative are processed transiently and are not written to our databases, logs, or backups. Our systems retain only content-free usage metadata about the request (feature name, model used, token counts, latency, processing status, estimated cost) for billing, abuse prevention, and reliability.
• At the AI provider: Anthropic keeps it only under its standard commercial API terms. The AI provider deletes the summary within 30 days — unless its automated safety systems flag the request, in which case it may keep it for up to two years — and never uses it to train models. We have no separate zero-data-retention agreement with it, and, like any company, it may keep a request for longer where the law requires it to.

Provider changes: we name our AI provider here deliberately. Adding or replacing a provider is a change to this policy — we will update it and, where the change is material, ask for your consent again before your data reaches a new provider.

3.3 Account and device data (on our servers)

Pausa works without registration. On first launch the app creates a pseudonymous account:

• A random account identifier (UUID) — not derived from your name, email, phone number, or any Apple identifier.
• Device basics: a random device identifier we assign at first launch, platform (“ios”), OS version, device model — used for sessions, compatibility and abuse prevention.
• Session credentials: short-lived access tokens and rotating refresh tokens (stored server-side only as cryptographic hashes).
• Push notification token, only if you enable notifications.
• Notification preference (marketing_push on/off — see §10).

There is no sign-in of any kind: Pausa never asks for your name, email address or phone number.

3.4 Purchases and subscription state

Payments are processed by Apple through the App Store; we never see your payment card details. To know which features you’re entitled to, we use RevenueCat (subscription management) which processes: your pseudonymous account identifier, product identifier, subscription state (trial, active, cancelled, billing issue, expired), period dates, and store transaction identifiers. Our servers keep a mirror of that entitlement state.

3.5 Usage analytics (content-free, EU-hosted)

We measure how the product performs using PostHog (EU Cloud, hosted in the EU). Analytics never contain your health entries — this is an engineering rule, not just a policy: apps on the nexapps platform cannot send analytics directly; events flow through our server, which stamps identity server-side and forwards a fixed, content-free event taxonomy.

• Examples of events: app opened, onboarding step completed, check-in completed (the fact, never the contents), narrative generated (metadata only), paywall viewed, trial started, subscription renewed, notification opened.
• Properties attached: pseudonymous account identifier, app identifier, subscription status, days since install, app version, platform.
• Never attached: symptom names, severities, cycle data, narrative text, or any health content.
• Onboarding may ask non-clinical product questions (e.g. “where else do you track?”); answers are recorded as content-free analytics choices, not health entries.

3.6 Diagnostics

Crash and error reports via Sentry (EU region), configured to scrub personal data. No health content, emails, tokens, or request/response bodies are included in error reports or server logs. Error reports carry no account identifier. Sentry’s own software adds a hashed device identifier to each error report and a random installation identifier to its app-stability data, so that reports from one installation can be grouped; neither is connected to your account.

3.7 Transactional email

Pausa never asks for your email address, so we send you no email — no marketing email, and no account email either: account deletion is confirmed in the app (§7). If you write to us, we use your address and your message only to answer you; our mailbox is hosted by Google (Google Workspace).

3.8 What we never collect

No precise location. No contacts. No photos. No microphone. No browsing or search history. No advertising identifiers (no ATT prompt — there is nothing to track). No third-party advertising or tracking SDKs. We do not sell or rent any data, and we do not share any data for advertising. Pausa shows no ads and embeds no third-party trackers or advertising identifiers — there is nothing to track.

4. Purposes and legal bases

Where the law of the country you live in requires your consent for a purpose in this table, consent is the basis we rely on for it: for health data and the AI summary, the explicit consent you give on the in-app consent screen (§11), which you can withdraw in the app at any time; for the other purposes, the consent you give by using Pausa after this policy has been made available to you, which you can withdraw by deleting your account (§7).

Health-related data is never used for advertising, marketing, data mining, or any purpose other than the health-management features you asked for (this is also an App Store rule for health apps, Guideline 5.1.3(i), and we adopt it as a binding commitment).

5. Who receives data (named processors)

We use a small number of service providers (“processors”). Each processes data for us under its own data-processing terms. We confirm, per Apple Guideline 5.1.1(i), that each provides the same or equal protection of your data as stated here.

We have no advertising partners, no data brokers, and no affiliates. We do not disclose health-related data to any third party except the processors above, for the purposes above, with your consent where required.

6. International transfers

Pausa is operated from Türkiye, our servers are in Germany, and some of the processors in §5 are in the United States. Using Pausa therefore moves data across borders: to our servers in Germany (Hetzner), to the EU-hosted analytics and crash-reporting services (PostHog, Sentry), and to processors based in the United States — Anthropic for the transient AI summary, RevenueCat for subscription state, Cloudflare for encrypted backups, and Google for any email you send us. Anthropic may also process the summary in Europe, Asia or Australia (§3.2). Each receives only the data §5 lists, for the purpose §5 states, and processes it under its own data-processing terms.

7. Retention and deletion

Deleting your account (in-app)

Settings → Delete Account. This is available to every user, requires no phone call or email, and does the following:

1. Immediately on our servers: your account is closed and its personal data deleted; devices and session tokens are destroyed; AI usage metadata is unlinked from you. What remains is the account’s random identifier with a few content-free status fields, purged 30 days later — later only if a processor has not yet confirmed its deletion (step 3) — and your consent records (table above), which we keep.
2. On your device: the app wipes its local database — your symptom history, narratives, and reports are erased (export first if you want to keep them). A backup of your iPhone made before the deletion keeps its copy until that backup is replaced or deleted (§3.1).
3. At our processors (completed within 30 days): deletion of your analytics person profile at PostHog and your subscriber record at RevenueCat.
4. Confirmation: shown in the app.
5. Backups: deleted records persist only inside encrypted backups until those expire per the schedule above; backups are used solely for disaster recovery and are not used to “restore” deleted accounts.

Important: deleting your account does not cancel an active App Store subscription — Apple controls billing. Cancel in iOS Settings → Apple Account → Subscriptions, ideally before deleting your account. The app reminds you of this in the deletion flow.

You can also revoke AI consent without deleting anything — see §11.

8. Your rights

Depending on where you live, you have the rights below. Exercise any of them in-app (deletion, consent revocation, export) or by contacting support@nexapps.co. We do not discriminate against you for exercising rights.

• Everyone: access/copy of your server-side data; deletion; consent withdrawal; correction; complaint.
• EEA/UK (GDPR Arts. 15–22): access, rectification, erasure, restriction, portability, objection (including to legitimate-interest processing), withdrawal of consent without affecting prior processing, and complaint to your supervisory authority.
• Türkiye (KVKK Art. 11): learning whether your data is processed, requesting information, learning the purpose, knowing third-party recipients, correction, erasure/destruction (Art. 7), notification of correction/erasure to recipients, objection to solely-automated adverse results, and compensation for unlawful processing. Send your application to support@nexapps.co; applications are answered within 30 days per KVKK Art. 13 and the Veri Sorumlusuna Başvuru Tebliği.
• US state health-data laws: see §9.

Most of your data is on your device, where “access” and “portability” are direct: the encrypted local export gives you a complete copy of your health data without asking us.

9. US consumer health data (Washington MHMDA and similar laws)

The section below is our Consumer Health Data notice. It is also published as a standalone Consumer Health Data Notice, which is the authoritative version and the target of every Consumer Health Data link on the site.

This is Pausa’s Consumer Health Data Privacy Policy for the Washington My Health My Data Act (RCW 19.373), the Nevada consumer health data law (SB 370), the Connecticut Data Privacy Act’s consumer-health provisions, and similar U.S. state laws.

Categories of consumer health data we collect, and why:

Sources: you (your in-app entries) and your device. Sharing: consumer health data is disclosed only to the processors named in Pausa’s Privacy Policy (the AI provider, under the transient-summary disclosure and only with your consent; infrastructure providers), each acting under its own data-processing terms. We have no affiliates. We do not sell consumer health data and do not share it for advertising. We do not use geofencing, and specifically do not geofence around any facility providing in-person health care.

Consent: we collect and process consumer health data only with your consent, obtained through a separate, plain-language in-app consent screen (not bundled into general terms acceptance) before Pausa sends any health data off your device. Collection limited to your device happens as part of the service you signed up for; nothing is transmitted without the separate consent.

Your rights (WA/NV/CT residents): the right to confirm whether we collect or share consumer health data; to access it, including a list of the third parties (and any affiliates) it was shared with; to withdraw consent; and to have it deleted — including propagation of the deletion to our processors and, on the timeline in Pausa’s Privacy Policy, to backups. Submit requests in-app or to support@nexapps.co. We respond within 45 days (extendable once by 45 days where reasonably necessary). If we refuse a request, you may appeal by replying to our decision or writing to us with the subject “Health data appeal”; we decide appeals within 45 days and, if the appeal is denied, we provide a way to contact the Washington Attorney General (or your state’s equivalent) to raise a concern.

Legal process (our subpoena policy): we do not disclose consumer health data to government entities or litigants except upon valid, binding legal process, which we review and construe narrowly; where lawful, we notify you before disclosure. Structurally, the most protective answer is architectural: we cannot produce symptom histories we do not possess — your logs are on your device, not on our servers, and we do not store the transient AI summaries. What could be produced from our systems is limited to the pseudonymous account, subscription, and content-free usage records described in Pausa’s Privacy Policy.

10. Notifications and marketing choices

• Notifications are optional and controlled by iOS permission; the app never requires them.
• Pausa may send: (a) reminders you set (scheduled on-device), and (b) subscription-lifecycle notifications from our servers (e.g. trial-ending reminders, billing-issue and win-back notices). The promotional/marketing-style ones can be turned off with the in-app notifications toggle (Settings → Notifications), independent of iOS settings, as required by App Store Guideline 4.5.4.
• No marketing email. No third-party marketing of any kind. Health data is never used for marketing (see §4).

11. Consent, and how to revoke it

Before Pausa’s first AI call, you see a consent screen describing exactly what §3.2 describes: what is sent, to whom (Anthropic), and that nothing is stored on our servers. We record the fact, time, and version of your consent (a content-free record) as required by Apple Guideline 5.1.2(i) and applicable law.

• Declining or revoking is a first-class path: daily logging, trends, streaks, and your existing narratives keep working entirely on-device. Only new narratives/reports pause, because they are the feature that needs the AI call.
• Revoke anytime: Settings → Privacy → “Weekly narrative & AI processing” toggle. Revocation stops all future transmissions immediately.
• Re-consent is asked if the named provider or the nature of the data sent materially changes.

12. Security

TLS encryption for everything in transit; local data protected by iOS data protection; session tokens stored in the device Keychain; server-side refresh tokens stored only as hashes; backups encrypted with keys that are never stored on our servers; EU hosting; strict server hardening; no health content in logs; provider API keys never present in the app. No system is perfectly secure; if a breach affects you, we will notify you and regulators as required by law (including the FTC Health Breach Notification Rule where applicable).

13. Children

Pausa is a perimenopause app for adults. It is not directed to children, and we do not knowingly collect data from anyone under 16. If you believe a child under 16 has used Pausa, contact us and we will delete the associated data.

14. Changes to this policy

We will post changes here with a new effective date, and for material changes (for example, a new AI provider or any new category of data leaving your device) we will notify you in-app and, where required, ask for fresh consent. Prior versions available on request.

15. Contact

Nexapps Bilişim ve Yazılım Hizmetleri Limited Şirketi — data controller
Soğanlık Yeni Mah., Soğanlık D-100 Kuzey Yanyol Cad., A Blok No: 72/2, İç Kapı No: 10, Kartal, İstanbul, Türkiye
Email: support@nexapps.co

Applications under Türkiye’s KVKK go to the same address and are answered within 30 days — see §8.